Is there a public PoC exploit available for CVE-2025-11663?

Yes, a public proof-of-concept exploit is available for CVE-2025-11663. Prioritise patching immediately. EPSS: 0.0%.

Campcodes Online Beauty Parlor Management System CVE-2025-11663

Q: What is the CVSS score of CVE-2025-11663?

CVE-2025-11663 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-13 cna@vuldb.com

PHP SQLi Online Beauty Parlor Management System Campcodes

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:17 vuln.today

DescriptionCVE.org

A weakness has been identified in Campcodes Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/manage-services.php. This manipulation of the argument sername causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in Campcodes Online Beauty Parlor Management System 1.0 allows authenticated high-privilege administrators to execute arbitrary SQL queries via the sername parameter in /admin/manage-services.php. The vulnerability requires high administrative privileges and has publicly available exploit code, though real-world impact is limited by its requirement for already-compromised admin accounts with no lateral movement or privilege escalation capability.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements used in an SQL Command) in a PHP-based web application. The /admin/manage-services.php endpoint directly concatenates user-supplied input from the sername parameter into SQL queries without proper parameterization or prepared statements. The affected product is Campcodes Online Beauty Parlor Management System version 1.0, a commercial salon management platform built in PHP. The SQL injection occurs in an administrative function, meaning the attack surface is limited to users with admin-level access to the application backend.

RemediationAI

Vendor patch status for this CVE has not been independently confirmed from official Campcodes sources. Immediate mitigation requires parameterized queries (prepared statements) using PHP PDO or mysqli with bound parameters to replace the current string concatenation in /admin/manage-services.php. As a temporary compensating control, implement strict input validation on the sername parameter to allow only alphanumeric characters and reject any input containing SQL metacharacters (quotes, semicolons, operators). Additionally, apply the principle of least privilege to admin accounts - restrict admin panel access to specific IP ranges or VPN, enforce multi-factor authentication for admin login, and implement database-level permissions so the PHP application user account has only SELECT, UPDATE, DELETE permissions on necessary tables without CREATE, ALTER, or DROP privileges. Monitor admin activity logs for suspicious SQL queries. Contact Campcodes directly via www.campcodes.com to request a patched version or security advisory.